LastPass got hacked: Change your master password NOW Password-storing cloud biz LastPass is urging its users to change their master passwords after hackers broke into its network at the end of last week. The intrusion reportedly happened on Friday afternoon, but many LastPass users are only learning about it now. LastPass last had a security scare in 2011. "In our investigation …
so they surely haven't emailed everyone
You amaze me. Maybe they like to think that their user base has more sense than to respond to: "Dear Lastpass user. It is now important to update your account details. Please login at the following link: https://wecantbelieveyoufellforthisyoutwat.moodyhost.com.".
Other possibility. They did, but messages like that go straight to your spam bucket....
Hmmm. It arrived this morning at 04:04...
"We are confident that the encryption algorithms we use will sufficiently protect our users. To further ensure your security, we are requiring verification by email when logging in from a new device or IP address, and will be prompting users to update their master passwords"
Either they're confident and I don't need to change or they're not...
And my last bloody spam-free email address is now for sale :(
"And my last bloody spam-free email address is now for sale :("
Buy the cheapest domain you can find.
Point the MX record at the cheapest of cheap VPS.
apt-get install postfix dovecot
Then use whatever you want@domain.com - i.e the name of company you give it to - theregister@mydomain.com
Every time you give out an email put it on a whitelist, everytime you get an unsolicited spam, put that company's email in the block list.
And if you want you can just forward all email to another address (or even duplicate it all to, say, a GMail address) for security. Hell, you can make your backup MX be your domain registrar's original so if the VPS goes down, email just gets forwarded a normal.
It gets me that techy people aren't running their own domain but complain about spam.
"I'm not techy (enough), but I really want to be doing this."
Look for a host that provides Plesk on the VPS, it provides a nice user friendly front-end for configuring e-mail aliases.
http://support.hostgator.com/img/articles/EmailAliasScreen.png
Note: above image is just for visuals, I know nothing about Hostgator or how good they are, it's certainly not a recommendation to use them.
FastMail makes this painless, and is super flexible. Great spam tools, best IMAP support, dynamic email addresses, good support, FTP/WebDAV support. Also gives you shared webspace, great for static sites, or cloaked redirects (aka proxy) to things like Google Docs, linkedin.yourdomain.com, etc.
https://www.fastmail.com/help/ourservice/hosteddomains.html
https://www.fastmail.com/help/receive/domains.html
"You amaze me. Maybe they like to think that their user base has more sense than to respond to: "Dear Lastpass user. It is now important to update your account details. Please login at the following link: https://wecantbelieveyoufellforthisyoutwat.moodyhost.com."."
No, what you tend to expect is something along the lines of:
"we have had a breach, go to the site as normal and change your password - we wont provide a link so you know this email is genuine".
"However, if your master password is complex, you should be safe – it will take an attacker far too long to crack your passphrase. Setting up two-factor authentication kills the problem dead, anyway."
Remember there are two different things:
1. Access to the web service to get your encrypted password file
2. Decrypting your password file
The two-factor authenticatation only helps for (1). If they have already broken into the system and downloaded your encrypted password file then turning on two-factor auth won't make any difference.
The only thing which really protects you is the (static) passphrase used to encrypt your password file.
1. They store your passwords on their servers; 2. Their servers can and do get hacked; 3. If you enter your master password when their servers are compromised, the hackers can decrypt all your saved passwords.
It's a significant risk. For anything beyond "silly social crap" you need a local app + file sync (or version control), compartmentalized with separate master passwords for different teams and security levels. Nope, there isn't a good answer for non-nerds.
Yeah, that'll work, because I know so much more about system security than the people at LastPass.
Seriously: pen and paper. A pocket book of some sort. Post-It notes. Physical security is a well understood problem, we've been thinking about it all our lives for several generations now, we know when we've been breached. Digital security is not going to reach maturity in my lifetime.
Or 1Password which lets you store the DB locally (not in the cloud) and sync to mobile devices over Wi-fi (e.g. at home).
Probably want to avoid the browser plugins as well unless you want to trust code running in the browser's address space with access to all of your passwords (I don't).
Yeah, that'll work, because I know so much more about system security than the people at LastPass.
The people at Lastpass just strangers, and are not responsible for your security. It is no skin off their nose if your bank account is emptied. Trusting your life/fortune to random Internet companies is about as responsible as taking sweets from a stranger.
The exception would be if you had a contract with Lastpass forcing them to reimburse any losses you suffer, without limit, and pay damages on top. Is that the case ?
"Just use a password protected Excel sheet. "
Not sure if you're joking, but just in case you're not, google 'break excel password' and you'll find lots of workarounds including this one:
http://community.spiceworks.com/topic/328118-need-to-unlock-a-password-protected-excel-2010-workbook
Excel is never the answer. Regardless of the question.
"Not sure if you're joking, but just in case you're not, google 'break excel password' and you'll find lots of workarounds including this one:"
Obviously you didn't read your own link all the way through. Encrypted Excel files are secure, there is no workaround, the only way to unlock them is a brute force attack - which is not feasible for a complex password (say 10 varied characters / symbols upwards)
Do you ever listen to "K-BILLY's Super Haxx of 2015 weekend"? It's my favorite station!
"K-BILLY's Super Haxx of 2015 continues. And if you're the tenth slurped one you'll win two tickets to the monster hack extravaganza being held this year at the NSA Fairgrounds featuring Big Daddy Alexander's truck, "The Oh-Bahmer.", accompanied by Russian and Chinese hotrods. The 10th victim wins on the station where the pwnerage survives. And we will now continue with the Lastpass song , "Won't somebody somehow think of my master password"...
Use EnPass, has full syncing, has apps for multiple platforms, has no account on a 3rd party server - instead opting to let you control your own data and do syncing via whatever cloud backup provider you prefer - I use Google Drive. The data is obviously encrypted with your master password before being transferred.
Like the idea but keeping my password vault in my drive account… not sure about that, eggs and baskets etc. If you are ‘connected’ you have to be prepared to trust someone (accounts, data, personal details etc) there is no getting away from it.
Have looked around for solutions which meet my requirements and Lastpass were (and still are quite frankly) providing a professional solution for a more than reasonable fee.
They detect an intrusion (not really huge news these days), they investigate, assess the impact and advise me accordingly, within a reasonable timeframe, given the protection already provided to me by
A. the encryption and B. ‘the protection of the herd’ ( my vault is one of thousands).
Changed my password, job done with no drama………
Hmm. Only just saw the article on the register about this at 03:30 on Tuesday morning. Double checked my inbox and spam filters, and nope - nothing from LastPass about this, darnit. If they're still sending out reminder e-mails they're certainly taking their time!
So I've just gone in and changed my Master Password myself, just in case. Hope that doesn't somehow come back to bite me.
This post has been deleted by its author
This post has been deleted by its author
This post has been deleted by its author
Actually worse for you than that. For a collision-free hashing algorithm the safe limit is for the total length of the clear text to not exceed the length of the hash (in bits). If it does, there _will_ be (not just may be) collisions. So very long plaintexts (regardless of their make-up) actually make the attacker's job more rewarding, as brute forcing a given hash may yield more than one plaintext. Thus the attacker can potentially obtain more credentials from the same number of captured hashes.
However your '50% probability' depends on the hashing algorithm's transfer function having a uniform distribution. I'm not sure whether it does, but I'd be surprised if it did considering the principle of how it works.
Where do you plug that into an iPhone?
I'm hoping my 26 character long masterkey is strong enough with alphanumeric and special characters, but I've changed to a longer key just in case.
From my perspective, it comes down to the risk of using a salted cloud based flexible solution that works on windows, mac and ios vs having to manually copy encrypted password files around which I probably would not do, or would not keep all my devices up-to-date. Some have suggested encrypting a file and putting on drop-box, but I don't see that as being any more secure than LastPass.
> Where do you plug that into an iPhone?
Using the USB camera connection kit.
https://www.yubico.com/faq/yubikey-ios-device-ipad-iphone/
Not that it helps you much unless the web applications you use support Yubikey OTP (few do).
You can store a long random password in a Yubikey, but then you'd be using the same long random password on every web service, which is obviously no good.
Unfortunately the NFC-enabled Yubikey is a non-starter until Apple open up the iPhone's NFC for third party use. Yubico take a guess at something from 12 to 16 months from launch last year. With Apple pay only just launching outside the US, I suspect it might be longer still to keep out any third party payment options that might compete.
You could use one of the versions of Authenticator, which would work on the iphone, but you'd have to give up using Yubikey on the desktop.
"Where do you plug that into an iPhone?"
There's a version that gives NFC capabilities, so you can tap it against your iPhone.
If your iPhone doesn't support that, which is surprising as it's a £500+ phone, then I feel bad for you son. I got 99 problems but a phone with no NFC isn't one.
Hit me.
So as a yubikey user, according the lastpass statement,
two-factor authentication kills the problem dead. (how ?)
I have a long-ish (18char) master password,
and use yubikey for 2nd factor...
whats the risk for me.
as for the possibility of requiring re-encrypting for Govt. backdoors... that is a scary thought.
Yubikeys come with a variety of different authentication mechanisms, depending on which variant you get, though a popular one is OTP. Secure? Up to a point, but remember SecurID?
And, of course, even unhacked it doesn't obviate MITM, and nor will some of the cryptographically-stronger options.
It's a jungle out there...
So what is your suggestion for those of us living in a mobile world and not chained to one device? I need to access my accounts, including banking and e-mail from my iPhone, mac at home and windows PC at the office that has the USB ports disabled. I'm keen to hear of suggestions that are easy to use, reliable and secure.
No, users can't wait till they get home, because when they're away from home, they're living their lives, and that means needing access to vital data. Whether it's my business clients travelling abroad, or my offsprogs' day-to-day London life, usernames and passwords, and other security/identity information, are needed all the time - when things are going fine and even more so when there's a problem.
For the techno-savvy there may be "better" solutions than LastPass and its ilk, but for the rest of the planet, those solutions will not be better because they won't be usable and they won't be used.
Said with some feeling having spent too much time recently helping my hapless users - and some of my more hapful users too - sort out username/password messes. Apple IDs being the most troublesome.
One option, off the top of my head: take a piece of paper, write your passwords on it, stick it in your wallet.
That way, you'll know what they all are (primary function), they will be almost completely secure (primary requirement) and you'll know who has access to them, and if/when they've been stolen.
Don't have to be particularly techno-savvy to drive a biro.
"How about using one of the many password keeper programs that can run on all your platforms? Most of them make it very easy to copy your password data between platforms."
Assuming you can actually COPY them, which may not be possible on a platform where local storage is restricted BUT you still need to be able to get the password to the site RIGHT F'N NOW.
As for the paper in the wallet, people have been pickpocketed in the past without their knowledge. AND their memories are bad enough they can't decide if it was "RositaChiquitaSenorita" or "SenoritaPequitaRosita".
I have a password keeper on my phone. The encrypted database file is not held anywhere on the internet, or backed up to any network device. I always have my phone with me. If I were to lose it I would initiate a remote wipe.
I have backups of the encrypted database file on usb and cd hidden in my house.
This is as safe as I need to be.
I don't believe that this makes me "chained" to one device.; Yes, I need to have my phone with me but I am able to read and then type the passwords onto other devices.
You're basically storing all of your passwords on someone else's computer, using software you have no way of validating, running on servers who's configuration you have no way of validating.
I always get looked at like the internet-age version of a luddite for saying 'maybe some things shouldn't be on the cloud' ... but I'm glad I stuck to my principles on this one.
"... but I'm glad I stuck to my principles on this one."
I half stuck to mine. I use Lastpass for a huge number of sites that don't involve money or anything else that could do appreciable damage, so mainly it's forums, site commenting, travel info etc. I just felt a bit queasy at the prospect of parking banking details etc in the cloud, and there's few enough of those to remember.
It's a bit moot anyway since for a lot of sites if you breech the users email account you can reset the passwords.
Yes having a password vault is an eggs in one basket type solution but properly encrypted with a decent master password it's probably safer than re-using the same password everywhere and you could always use it for the less important sites, like forums and such.
(I will buy a virtual beer for anyone who can name the programme, and character for this next quote !)
"A patient died. And now you want to close the whole hospital !"
I use LastPass. It's cloudiness is an asset - it means I can use *any* machine to access secure sites.
I accept I am trading convenience for security. I've evaluated the risks, and decided they are worth it.
Current count is >300 unique passwords stored, none of which is less than 12 characters, and all of which are generated nonsense.
I'm with you JimmyPage. God knows how many passwords I've got stored in LastPass, and like you're they're all gibberish. My master password is about 33 characters long, and I'm quite happy with that. Like everyone else I didn't get the email until yesterday, but fully accept that this was probably because LP were in the middle of a thorough investigation that took them 3 days to complete.
I'd rather a company took this long to uncover all the facts, instead of just throwing panic-stricken "the sky is falling" emails out minutes after the event with minimal information whatsoever. Immediate information is not necessarily accurate information.
Sadly a lot of the comments here seem to be gleefully beating LastPass about the head for a) being hacked and b) simply existing. That and laughing smugly at other commentards who dare to be so stupid as to use a cloud-based password storage company...unaware of the irony in being quite happy to use a cloud-based auction site, cloud-based email, essentially cloud-based Internet Banking...
"unaware of the irony in being quite happy to use a cloud-based auction site, cloud-based email, essentially cloud-based Internet Banking..."
Who are you talking about? I use none of those things, for the same reason that I wouldn't touch something like LastPass.
"Who are you talking about? I use none of those things, for the same reason that I wouldn't touch something like LastPass."
Yeah, 'cos when I make a general statement about something on the Internet, I do of course mean it to apply to absolutely everybody who will ever read my comment, and that includes you. Even though I have no idea who you are, or that you existed up until this second. I'm afraid you are wrong. You do use eBay and you do use Internet Banking. Because I say so. And I am right. Because I am commenting on the Internet.
Ooops, might have overdone the f***ing irony there. Jeez!
Tell you what. Have a Big Grin just in case you think I'm being serious. :D
But you DO. If they break into ONE shite site, they can use that to log onto your other shite sites. Which allows them to build a profile on you that lets them run a believable spear phishing attack on you to get to the higher tiers.
Put it this way. Even the most useless bit of detritus you leave on the Net can be used to cobble together an identity theft.
Another problem with passwords is that a lot of people find it difficult to make them random enough. In the late 80s I was having a discussion about passwords with a programmer in the IT dept I worked in at the time. He smugly claimed that nobody would ever guess his password. I stepped back, looked him up and down and said "cyberman". "You bastard!" the dyed-in-the-wool Dr Who fan said.
This is a true story.
I've got a text file, encrypted with a password into Winzip which I store on my Synology NAS drive accessible remotely.
In that, I don't have my passwords, but I have mnemonics which only I can relate to. So, for example, I would say "my old village" and I know that it is the village I used to live in. Anyone who did manage to get hold of my file and decrypt it would also need to know a lot about me.
Of course, once I get into my dotage and forget things, it will not work, but by that time, I won't actually care :)
Alan
Or they could just use a modern dictionary attack, which would probably have the name of your village, combined with common number and symbol substitutions and suffixes.
LastPass, on the other hand, will generate a 20 character totally random password for you, and allow you to use it as you don't have to remember it. And let's not forget, LastPass accounts haven't actually been compromised in this attack.
This reminds me of Fukushima.
Lots of fuss about nuclear disasters, release of radiation, how it was all a terrible idea. But nobody died and radiation leakage was small.
Likewise, there's no suggestion that anyone's passwords have been compromised here. That's kind of the take-home lesson, I think: LastPass was attacked and held up.
This post has been deleted by its author
...And doesn't take away from the fact that hundreds of thousands of people were displaced by the Fuku event... Something rotten in the Pacific too, lots of sea creatures getting washed up all along the eastern seaboard, what's that about? Radiation not being detected, but is it some unintended consequences?
Honestly, if you supply a US based company with a US hosted website with your personal passwords you need your head examined.
What will happen next:
- some mea culpa's
- some finger wagging from the FTC of the "thy shall" nature
- at best a minuscule fine
- some LastPass announcement that is replete with jargon and technology statements
- absolutely no admission of liability
- give it two weeks, and the clients will be back. At least the bleating ones.
part of the problem with passwords - internet passwords specifically - is the total lack of anything remotely resembling an RFC on the best practices to implement password-based authentication.
Is the password complexity sufficient ?
Is the password stored in plaintext ? (Because some are, so you can be emailed it if you forget)
If the password is encrypted, can it be decrypted ?
If so by who ?
Is a regular password change mandated ?
etc etc etc
I wonder, if I was to setup a site requiring a login to be created, and harvested all the email address/password combinations people used, how far I could get trying those credentials elsewhere.
However, before I did that, I'd also wonder if anyone else had done it before me ?
Quick question. What's the ISO reference for web-based authentication ?
just got my email from Lastpass
We wanted to alert you that, recently, our team discovered and immediately blocked suspicious activity on our network. No encrypted user vault data was taken, however other data, including email addresses and password reminders, was compromised.
We are confident that the encryption algorithms we use will sufficiently protect our users. To further ensure your security, we are requiring verification by email when logging in from a new device or IP address, and will be prompting users to update their master passwords.
interesting use of other data by them.
Lastpass get your act together.
.. Don't worry at all if your password was complex enough? That's the takeaway I get. Is that wrong? Mine is 15 characters with all different types and not dictionary. I am aware of no breakthrough in GPUs or what-not that can realistically bust that before I am too dead to care.
I operate under the assumption that a hacker will have access to the hash database at some point. For every "breach" that's announced, how many happen that the company is either unaware of, or never cops to?
If your passwords are stored in your head, you're either an idiot or you have an exceptional ability to remember 20 character random strings.
If your passwords are stored electronically, assume the hashes are available to hackers. If you're relying on obscurity to protect your passwords, you're doing it wrong. LastPass remains an excellent system as long as your master password is long and complex.
I sometimes wonder if an ideal password locker would actually be totally in the open, with all the encrypted password files available for open download and inspection by everyone. Maybe the password locker service could even hold an annual "crack the password" competition.
That would cause people to treat their master password with the respect it deserves.
"I sometimes wonder if an ideal password locker would actually be totally in the open, with all the encrypted password files available for open download and inspection by everyone. Maybe the password locker service could even hold an annual "crack the password" competition."
How would you hold such a competition without getting sued up the wazoo for breach of privacy?
This post has been deleted by its author
And what's to stop a more-sophisticated password cracker looking up books and song lyrics and trying the first-letter approach, complete with leetspeak substitutions? Plus as noted, it gets complicated once you add up the sites. Soon you'll be thinking, "Was it 'correct horse battery staple' or 'staple horse battery correct'? Or was it 'Rosita Chiquita Senorita' or 'Senorita Chiquita Juanita'?" Why do you think "password reset" attacks are becoming more common? The average human brain simply cannot cope, and there's really nothing better on offer that can't be copied or stolen.
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
